EO 14409 Locks Federal Agencies to 2030 PQC Deadline for Key Establishment

The order accelerates the prior NSM-10 timeline by four years and directly references harvest-now decrypt-later collection by adversaries. It requires agency PQC leads within 30 days, OMB guidance within 90 days, and NIST pilot completion by end-2027. FAR Council rules due in 180-270 days will extend equivalent obligations to covered contractors, creating procurement pressure absent from earlier voluntary frameworks.

CISA and NIST must publish cryptographic bill-of-materials minimum elements within 270 days, addressing the inventory gap that has stalled prior crypto migrations. The separate track for national security systems and non-mandatory language for Sector Risk Management Agencies on critical infrastructure reveal the order's uneven reach. Companion quantum innovation order signed same day underscores the dual-track policy of both accelerating migration and funding the machines that justify it.

Technical attribution of risk remains collection-focused rather than quantum-computer deployment timelines; no independent verification of foreign stockpiling volumes exists in open sources. Agencies lacking current cryptographic inventories will face the steepest compliance curve once FAR clauses activate.

OMB guidance and final FAR language will determine whether 2030 becomes enforceable or slips like previous federal IT mandates.